Blackberry ENTERPRISE SOLUTION SECURITY - ENTERPRISE SOLUTION - SECURITY TECHNICAL Overview page 27

BlackBerry Enterprise Solution
Notes .id password protection
After a BlackBerry device user imports the Notes .id file and password (stored in the Notes .id file), the password
is
•
encrypted in BlackBerry device memory using AES with the BlackBerry device user's master encryption key
•
encrypted in the BlackBerry Enterprise Server for IBM Lotus Domino messaging agent memory using AES
with the BlackBerry device user's master encryption key
•
decrypted before being used to call the required Lotus Notes API security functions
The BlackBerry Enterprise Server for IBM Lotus Domino messaging agent deletes the Notes .id files and plain
text passwords it stores when
•
a message decryption failure occurs on the BlackBerry Enterprise Server
•
the BlackBerry Enterprise Server restarts
•
the password times out (the default expiration timeout is 24 hours)
The encrypted Notes .id password remains stored in the BlackBerry Enterprise Server for IBM Lotus Domino
messaging agent memory cache. The BlackBerry Enterprise Server administrator can customize the length of
time for which the BlackBerry Enterprise Server for IBM Lotus Domino messaging agent caches the password.
The BlackBerry Enterprise Server administrator can also set the timeout value to 0 to require the BlackBerry
device user to type the Notes .id password to decrypt and read every Lotus Notes encrypted message the user
receives on the BlackBerry device. Visit
12420 "How to – Change the length of time for which the BlackBerry Enterprise Server for IBM Lotus Domino
messaging agent caches a Notes .id password" for more information on customizing the length of time for which
the BlackBerry Enterprise Server for IBM Lotus Domino messaging agent caches the password.
The BlackBerry device deletes the Notes .id files and plain text passwords from BlackBerry device memory when
•
a message decryption failure occurs on the BlackBerry device
•
the BlackBerry device resets
•
the password times out (the default expiration timeout period is 24 hours)
If a BlackBerry device user types more than ten consecutive incorrect passwords on the BlackBerry device within
one hour, the BlackBerry Enterprise Server for IBM Lotus Domino messaging agent makes secure messaging
unavailable to that BlackBerry device user for one hour.
The temporary disabling period increases by ten minute increments to a limit of 24 hours. It increments each
time a BlackBerry device user exceeds the maximum number of failed password attempts, and defaults back to
one hour when the user types the correct password.
When secure messaging is temporarily unavailable, a BlackBerry device user can manually re-enable secure
messaging by importing the Notes .id file, or changing the Notes .id password using the BlackBerry Desktop
Software or the Domino Web Access client.
www.blackberry.com
www.blackberry.com/knowledgecenterpublic/
27
to view the article KB-